CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. Simplified trace: dma_free_attrs mhi_deinit_dev_ctxt [mhi] ath11k_pci_power_down [ath11k_pci] ath11k_pci_shutdown [ath11k_pci] device_shutdown kernel_restart On the host side, SSR is driven by the MHI RDDM callback, which queues reset_work to perform device recovery. reset_work power-cycles the device by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The power-down phase deinitializes MHI and frees DMA resources. Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR recovery sequence. Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues reset_work. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once. Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue reset_work in normal SSR flows. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

• https://git.kernel.org/stable/c/53dd29e8aeb2a1b5f079178551836b85fc6b53df
• https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87

Published

Aug 15, 2026

Last Modified

Aug 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-74401In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-74402In the Linux kernel, the following vulnerability has been re…
• CVE-2026-74403In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74404In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74405In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74406In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-74408In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-74409In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-7441The Simple Yearly Archive plugin for WordPress is vulnerable…6.4
• CVE-2026-74410In the Linux kernel, the following vulnerability has been re…8.1
• CVE-2026-74411In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-74412In the Linux kernel, the following vulnerability has been re…8.8